Executable file

[Trey McNabb]

I have a file that seems to have shown up on 2/5/04
called "rm6kakz67r.exe", and created a pre-load as well.
Does anybody know what this is? I can't find it any
place on the MS website. When I pull up the task
manager, it seems to be running between 87%-100% on the
CPU. I noticed it when a game that had been running
smothly started acting up.

McAfee doesn't find anything wrong with the system.

Machine is an e-Machines 1.8GhZ WinXP.

Any help would be appreciated.

 

[Doug Knox MS-MVP]

Just the name itself would lead me to believe its malicious. There is a new variant of the Welchia worm out there, with little information, from Symantec at least.

http://securityresponse.symantec.com/avcenter/venc/data/w32.welchia.b.html

Did you try right clicking the file, selecting Properties, Version to see what the version information is? That may give a clue about where it came from.

Additionally, click Start, Run and enter MSCONFIG Go to the Startup tab and uncheck the entry for this item, if one exists.

You may also want to see www.dougknox.com, Win XP Utilities, Startup Programs Tracker. This small utility scans your system for startup programs and running processes. It also allows you to create a log file that can be copied and pasted into a newsgroup post. The contents of the program window are also copied to the Windows Clipboard, automatically.